/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.SetUtil;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.AttributeClass;
/*     */ import com.zimbra.cs.account.AttributeManager;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import java.util.HashMap;
/*     */ import java.util.HashSet;
/*     */ import java.util.Iterator;
/*     */ import java.util.List;
/*     */ import java.util.Map;
/*     */ import java.util.Map.Entry;
/*     */ import java.util.Set;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class CheckAttrRight
/*     */   extends CheckRight
/*     */ {
/*  37 */   private static final Log sLog = ZimbraLog.acl;
/*     */   private RightBearer.Grantee mGrantee;
/*     */   private AttrRight mAttrRightNeeded;
/*     */   
/*     */   static enum CollectAttrsResult
/*     */   {
/*  43 */     SOME(false), 
/*  44 */     ALLOW_ALL(true), 
/*  45 */     DENY_ALL(true);
/*     */     
/*     */     private boolean mIsAll;
/*     */     
/*     */     private CollectAttrsResult(boolean isAll) {
/*  50 */       this.mIsAll = isAll;
/*     */     }
/*     */     
/*     */     boolean isAll() {
/*  54 */       return this.mIsAll;
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */   public static AllowedAttrs accessibleAttrs(RightBearer.Grantee grantee, Entry target, AttrRight rightNeeded, boolean canDelegateNeeded)
/*     */     throws ServiceException
/*     */   {
/*  62 */     CheckAttrRight checker = new CheckAttrRight(grantee, target, rightNeeded, canDelegateNeeded);
/*     */     
/*     */ 
/*  65 */     return checker.computeAccessibleAttrs();
/*     */   }
/*     */   
/*     */   private CheckAttrRight(RightBearer.Grantee grantee, Entry target, AttrRight rightNeeded, boolean canDelegateNeeded) throws ServiceException
/*     */   {
/*  70 */     super(target, rightNeeded, canDelegateNeeded);
/*     */     
/*  72 */     this.mGrantee = grantee;
/*  73 */     this.mTargetType = TargetType.getTargetType(this.mTarget);
/*  74 */     this.mAttrRightNeeded = rightNeeded;
/*     */   }
/*     */   
/*     */   private AllowedAttrs computeAccessibleAttrs() throws ServiceException {
/*  78 */     if (this.mGrantee == null) {
/*  79 */       return AllowedAttrs.DENY_ALL_ATTRS();
/*     */     }
/*     */     
/*  82 */     Map<String, Integer> allowSome = new HashMap();
/*  83 */     Map<String, Integer> denySome = new HashMap();
/*  84 */     Integer relativity = Integer.valueOf(1);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*  91 */     int granteeRanksPerTarget = 2;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*  96 */     CollectAttrsResult car = CollectAttrsResult.SOME;
/*     */     
/*     */ 
/*  99 */     List<ZimbraACE> acl = ACLUtil.getAllACEs(this.mTarget);
/* 100 */     if (acl != null) {
/* 101 */       car = checkTarget(acl, relativity, false, allowSome, denySome);
/* 102 */       relativity = Integer.valueOf(relativity.intValue() + granteeRanksPerTarget);
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 109 */     Domain targetDomain = TargetType.getTargetDomain(this.mProv, this.mTarget);
/*     */     
/* 111 */     if (!car.isAll())
/*     */     {
/* 113 */       boolean expandTargetGroups = CheckRight.allowGroupTarget(this.mRightNeeded);
/* 114 */       TargetIterator iter = TargetIterator.getTargetIeterator(this.mProv, this.mTarget, expandTargetGroups);
/*     */       
/*     */ 
/* 117 */       GroupACLs groupACLs = null;
/*     */       Entry grantedOn;
/* 119 */       while (((grantedOn = iter.next()) != null) && (!car.isAll())) {
/* 120 */         acl = ACLUtil.getAllACEs(grantedOn);
/*     */         
/* 122 */         if ((grantedOn instanceof Group)) {
/* 123 */           if (acl != null)
/*     */           {
/*     */ 
/* 126 */             boolean skipPositiveGrants = false;
/*     */             
/*     */ 
/*     */ 
/* 130 */             if (this.mGrantee.isAccount()) {
/* 131 */               skipPositiveGrants = !CrossDomain.crossDomainOK(this.mProv, this.mGrantee.getAccount(), this.mGrantee.getDomain(), targetDomain, (Group)grantedOn);
/*     */             }
/*     */             
/*     */ 
/*     */ 
/*     */ 
/* 137 */             if (groupACLs == null) {
/* 138 */               groupACLs = new GroupACLs(this.mTarget);
/*     */             }
/* 140 */             groupACLs.collectACL((Group)grantedOn, skipPositiveGrants);
/*     */           }
/*     */           
/*     */         }
/*     */         else
/*     */         {
/* 146 */           if (groupACLs != null) {
/* 147 */             List<ZimbraACE> aclsOnGroupTargets = groupACLs.getAllACLs();
/* 148 */             if (aclsOnGroupTargets != null) {
/* 149 */               car = checkTarget(aclsOnGroupTargets, relativity, false, allowSome, denySome);
/* 150 */               relativity = Integer.valueOf(relativity.intValue() + granteeRanksPerTarget);
/* 151 */               if (car.isAll()) {
/*     */                 break;
/*     */               }
/*     */             }
/*     */             
/*     */ 
/* 157 */             groupACLs = null;
/*     */           }
/*     */           
/* 160 */           if (acl != null)
/*     */           {
/*     */ 
/* 163 */             boolean subDomain = (this.mTargetType == TargetType.domain) && ((grantedOn instanceof Domain));
/* 164 */             car = checkTarget(acl, relativity, subDomain, allowSome, denySome);
/* 165 */             relativity = Integer.valueOf(relativity.intValue() + granteeRanksPerTarget);
/*     */           }
/*     */         }
/*     */       }
/*     */     }
/*     */     
/* 171 */     if (sLog.isDebugEnabled()) {
/* 172 */       StringBuilder sb = new StringBuilder();
/*     */       
/* 174 */       sb.append("Allowed: {");
/* 175 */       for (Map.Entry<String, Integer> as : allowSome.entrySet()) {
/* 176 */         sb.append("(" + (String)as.getKey() + ", " + as.getValue() + ")");
/*     */       }
/* 178 */       sb.append("}");
/* 179 */       sb.append(" Denied: {");
/* 180 */       for (Map.Entry<String, Integer> ds : denySome.entrySet()) {
/* 181 */         sb.append("(" + (String)ds.getKey() + ", " + ds.getValue() + ")");
/*     */       }
/* 183 */       sb.append("}");
/*     */       
/*     */ 
/*     */ 
/* 187 */       if ((car == CollectAttrsResult.SOME) && (allowSome.isEmpty()) && (denySome.isEmpty())) {
/* 188 */         sLog.debug("accessibleAttrs: NONE");
/*     */       } else {
/* 190 */         sLog.debug("accessibleAttrs: " + car.name() + ". " + sb.toString());
/*     */       }
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 200 */     AttributeClass klass = TargetType.getAttributeClass(this.mTarget);
/*     */     AllowedAttrs result;
/* 202 */     AllowedAttrs result; if (car == CollectAttrsResult.ALLOW_ALL) {
/* 203 */       result = processAllowAll(allowSome, denySome, klass); } else { AllowedAttrs result;
/* 204 */       if (car == CollectAttrsResult.DENY_ALL) {
/* 205 */         result = processDenyAll(allowSome, denySome, klass);
/*     */       }
/*     */       else
/*     */       {
/* 209 */         Set<String> conflicts = SetUtil.intersect(allowSome.keySet(), denySome.keySet());
/* 210 */         if (!conflicts.isEmpty()) {
/* 211 */           for (String attr : conflicts) {
/* 212 */             if (((Integer)denySome.get(attr)).intValue() <= ((Integer)allowSome.get(attr)).intValue())
/* 213 */               allowSome.remove(attr);
/*     */           }
/*     */         }
/* 216 */         result = AllowedAttrs.ALLOW_SOME_ATTRS(allowSome.keySet());
/*     */       }
/*     */     }
/*     */     
/* 220 */     return result;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   private CollectAttrsResult checkTarget(List<ZimbraACE> acl, Integer relativity, boolean subDomain, Map<String, Integer> allowSome, Map<String, Integer> denySome)
/*     */     throws ServiceException
/*     */   {
/* 229 */     CollectAttrsResult result = null;
/*     */     
/*     */ 
/* 232 */     short granteeFlags = 3;
/* 233 */     result = expandACLToAttrs(acl, granteeFlags, relativity, subDomain, allowSome, denySome);
/* 234 */     if (result.isAll()) {
/* 235 */       return result;
/*     */     }
/*     */     
/* 238 */     granteeFlags = 4;
/* 239 */     result = expandACLToAttrs(acl, granteeFlags, Integer.valueOf(relativity.intValue() + 1), subDomain, allowSome, denySome);
/*     */     
/* 241 */     return result;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private CollectAttrsResult expandACLToAttrs(List<ZimbraACE> acl, short granteeFlags, Integer relativity, boolean subDomain, Map<String, Integer> allowSome, Map<String, Integer> denySome)
/*     */     throws ServiceException
/*     */   {
/* 289 */     CollectAttrsResult result = null;
/*     */     
/* 291 */     for (Iterator i$ = acl.iterator(); i$.hasNext();) { ace = (ZimbraACE)i$.next();
/* 292 */       GranteeType granteeType = ace.getGranteeType();
/* 293 */       if ((granteeType.hasFlags(granteeFlags)) && 
/*     */       
/*     */ 
/* 296 */         (RightBearer.matchesGrantee(this.mGrantee, ace)))
/*     */       {
/*     */ 
/*     */ 
/* 300 */         Right rightGranted = ace.getRight();
/* 301 */         if ((!rightGranted.isPresetRight()) && 
/*     */         
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 308 */           ((!this.mCanDelegateNeeded) || (!ace.canExecuteOnly())) && (
/*     */           
/*     */ 
/*     */ 
/*     */ 
/* 313 */           (ace.deny()) || 
/* 314 */           (subDomain == ace.subDomain())))
/*     */         {
/*     */ 
/*     */ 
/* 318 */           if (rightGranted.isAttrRight()) {
/* 319 */             AttrRight attrRight = (AttrRight)rightGranted;
/* 320 */             result = expandAttrsGrantToAttrs(ace, attrRight, relativity, allowSome, denySome);
/*     */             
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 329 */             if ((result != null) && (result.isAll())) {
/* 330 */               return result;
/*     */             }
/* 332 */           } else if (rightGranted.isComboRight()) {
/* 333 */             ComboRight comboRight = (ComboRight)rightGranted;
/* 334 */             for (AttrRight attrRight : comboRight.getAttrRights()) {
/* 335 */               result = expandAttrsGrantToAttrs(ace, attrRight, relativity, allowSome, denySome);
/*     */               
/* 337 */               if ((result != null) && (result.isAll()))
/* 338 */                 return result;
/*     */             }
/*     */           } }
/*     */       } }
/*     */     ZimbraACE ace;
/* 343 */     return CollectAttrsResult.SOME;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private CollectAttrsResult expandAttrsGrantToAttrs(ZimbraACE ace, AttrRight attrRightGranted, Integer relativity, Map<String, Integer> allowSome, Map<String, Integer> denySome)
/*     */     throws ServiceException
/*     */   {
/* 365 */     Right.RightType rightTypeNeeded = this.mAttrRightNeeded.getRightType();
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 370 */     if (!attrRightGranted.suitableFor(rightTypeNeeded)) {
/* 371 */       return null;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 379 */     if (!CheckRight.rightApplicableOnTargetType(this.mTargetType, attrRightGranted, this.mCanDelegateNeeded))
/*     */     {
/* 381 */       return null;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 412 */     if ((this.mAttrRightNeeded != AdminRight.PR_GET_ATTRS) && (this.mAttrRightNeeded != AdminRight.PR_SET_ATTRS))
/*     */     {
/* 414 */       if (SetUtil.intersect(attrRightGranted.getTargetTypes(), this.mAttrRightNeeded.getTargetTypes()).isEmpty()) {
/* 415 */         return null;
/*     */       }
/*     */     }
/* 418 */     if (attrRightGranted.allAttrs())
/*     */     {
/* 420 */       if (ace.deny())
/*     */       {
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 427 */         if (attrRightGranted.getRightType() == rightTypeNeeded) {
/* 428 */           return CollectAttrsResult.DENY_ALL;
/*     */         }
/* 430 */         return null;
/*     */       }
/* 432 */       return CollectAttrsResult.ALLOW_ALL;
/*     */     }
/*     */     
/*     */ 
/* 436 */     if (ace.deny()) {
/* 437 */       if (attrRightGranted.getRightType() == rightTypeNeeded) {
/* 438 */         for (String attrName : attrRightGranted.getAttrs()) {
/* 439 */           collectAttrRightIfMoreRelevant(attrName, ace.deny(), relativity, allowSome, denySome);
/*     */         }
/*     */       } else {
/* 442 */         return null;
/*     */       }
/*     */     } else {
/* 445 */       for (String attrName : attrRightGranted.getAttrs()) {
/* 446 */         collectAttrRightIfMoreRelevant(attrName, ace.deny(), relativity, allowSome, denySome);
/*     */       }
/*     */     }
/* 449 */     return CollectAttrsResult.SOME;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   private void collectAttrRightIfMoreRelevant(String attrName, boolean negative, Integer relativity, Map<String, Integer> allowed, Map<String, Integer> denied)
/*     */   {
/* 456 */     Map<String, Integer> map = negative ? denied : allowed;
/*     */     
/* 458 */     Integer mostRelevant = (Integer)map.get(attrName);
/* 459 */     if ((mostRelevant == null) || (relativity.intValue() < mostRelevant.intValue())) {
/* 460 */       map.put(attrName, relativity);
/*     */     }
/*     */   }
/*     */   
/*     */   private AllowedAttrs processDenyAll(Map<String, Integer> allowSome, Map<String, Integer> denySome, AttributeClass klass) throws ServiceException
/*     */   {
/* 466 */     if (allowSome.isEmpty()) {
/* 467 */       return AllowedAttrs.DENY_ALL_ATTRS();
/*     */     }
/* 469 */     Set<String> allowed = allowSome.keySet();
/* 470 */     return AllowedAttrs.ALLOW_SOME_ATTRS(allowed);
/*     */   }
/*     */   
/*     */ 
/*     */   private AllowedAttrs processAllowAll(Map<String, Integer> allowSome, Map<String, Integer> denySome, AttributeClass klass)
/*     */     throws ServiceException
/*     */   {
/* 477 */     if (denySome.isEmpty()) {
/* 478 */       return AllowedAttrs.ALLOW_ALL_ATTRS();
/*     */     }
/*     */     
/* 481 */     Set<String> allowed = new HashSet();
/* 482 */     allowed.addAll(AttributeManager.getInstance().getAllAttrsInClass(klass));
/*     */     
/*     */ 
/* 485 */     for (String d : denySome.keySet())
/* 486 */       allowed.remove(d);
/* 487 */     return AllowedAttrs.ALLOW_SOME_ATTRS(allowed);
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/CheckAttrRight.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */